Privacy Policy – Baumvolk

Personal data is processed insofar as this is necessary for the provision and technical security of the Baumvolk platform, the administration of user accounts, communication, the provision of requested services, and the prevention of misuse and fraud. Where corresponding functions are offered, this also includes the administration of events, courses, marketplace functions, or paid services.

Depending on the type and purpose of the processing, the following legal bases in particular may apply:

- Art. 6(1)(b) GDPR, insofar as the processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract,
- Art. 6(1)(a) GDPR, insofar as the processing is based on consent,
- Art. 6(1)(f) GDPR, insofar as the processing is necessary for the purposes of legitimate interests, in particular for the secure, stable, and functional operation of the platform and for protection against misuse and unauthorized access,
- Art. 6(1)(c) GDPR, insofar as the processing is necessary for compliance with a legal obligation.

This may include, in particular, master data such as name and username, contact data such as the email address, as well as user account and login data.

This may include, in particular, posts, comments, bonsai profiles, journal entries, photos, voluntarily submitted media contributions, copyright or credit information, as well as information about areas accessed and interactions within the platform.

This may include, in particular, metadata and communication data such as IP address, device information and timestamps, security and log data, as well as event, booking, and payment data, insofar as corresponding services are used.

The creation of a user account is required for certain functions of the Baumvolk platform. In this context, the data provided during registration, such as username and email address, as well as the data required for login and account administration, are processed. Mandatory information is marked accordingly.

The processing is generally carried out on the basis of Art. 6(1)(b) GDPR for the purpose of creating, administering, and securing the user account and providing the associated platform functions.

Security-related processing, in particular to protect against unauthorized access, automated login attempts, and misuse, may additionally be based on Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and reliable operation of the platform.

Users can create profiles, bonsai profiles, collections, journal entries, photos, comments, and other content within the Baumvolk platform. Depending on the function and selected visibility, this content may be public or visible only to certain users.

The processing is carried out on the basis of Art. 6(1)(b) GDPR in order to provide the selected platform functions. Publicly available content may be viewed by other persons and may also be found via search engines.

Users should not publish confidential data or personal data of third parties unless they have sufficient authorization to do so.

When photos or other files are uploaded, the uploaded content and the associated technical file information are processed.

Photos may contain embedded metadata, for example the time of capture, camera model, or location information. Users should remove such metadata before uploading if they do not want it to be processed or published. Where technically provided, metadata may be automatically removed or reduced by the platform.

Through the “Support with Media” function, individuals can voluntarily provide Baumvolk with photographs, images, and other media for use and publication.

As part of such a submission, the following data in particular may be processed: name, email address, any copyright, source, or credit line provided, voluntary information and notes relating to the submission, the submitted photographs, images, or other media, any personal information contained therein, as well as technical information associated with the transmission of the files.

The processing is carried out for the purpose of receiving, reviewing, assigning, and managing the media contributions, communicating with the submitting person, and using and publishing the media in accordance with the granted rights of use.

Insofar as the processing is necessary to receive the media transmission requested by the submitting person and to carry out the agreed use of the media, it is carried out on the basis of Art. 6(1)(b) GDPR.

Insofar as data is additionally stored for the purpose of documenting the granted rights of use and for the establishment, exercise, or defense of legal claims, the processing is carried out on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in particular in documenting the origin of the media contributions, the granted rights of use, and the lawfulness of their use.

A provided credit line or copyright attribution may be published together with the respective media contribution, insofar as this has been indicated or agreed by the submitting person.

The submitted media may be published in accordance with the granted rights of use, in particular on Baumvolk websites and platforms, social media profiles, newsletters, editorial publications, presentations, and as part of Baumvolk’s press, public relations, and advertising activities. As a result, the media and any personal information contained therein or associated with them may become visible to third parties.

Cookies and similar storage technologies are used insofar as they are necessary for the provision, security, and basic functionality of the website and platform. These include, in particular, WordPress cookies for login and sessions, as well as temporary cookies in connection with two-factor authentication. Insofar as such storage is strictly necessary to provide functions expressly requested by users, it is used in accordance with Section 25(2) TDDDG.

First-party cookies are used to store selected settings. The “bv_lang” cookie stores the selected language for non-logged-in users for up to 30 days. The “bv_user_consent” cookie stores the selected privacy settings for up to 180 days.

According to the current technical configuration, web analytics with Matomo is carried out without analytics cookies. Matomo therefore does not set its own tracking cookies. Further details on web analytics are provided in the section “Web Analytics with Matomo”.

The selected privacy and consent settings can be changed at any time with effect for the future via the Privacy Settings.

When this website and the Baumvolk platform are accessed, technical log data is automatically processed by the web server. This may include, in particular, IP address, date and time of access, requested URL or file, previously visited page, browser type and browser version, operating system, amount of data transferred, and HTTP status code.

The processing serves the technical provision, stability, and error analysis as well as protection against misuse, attacks, and unauthorized access. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and functional operation of the platform.

The log data is stored only for as long as is necessary for the stated purposes and is subsequently deleted or anonymized, unless further retention is required to investigate a security incident or due to legal obligations.

The self-hosted web analytics service Matomo is used for web analytics in order to evaluate the use of this website and the Baumvolk platform and to improve the service technically and in terms of content.

According to the current configuration, Matomo is operated without analytics cookies. The IP address is shortened by masking 2 bytes during processing in Matomo. In particular, pages accessed, time of access, browser used, operating system and device type, as well as technical information on the origin of the page view, are recorded.

The processing is carried out on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in the data-minimizing analysis and improvement of the platform. Matomo data is not disclosed to third parties for advertising purposes.

This website, the Baumvolk platform, and the associated database are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

As part of the hosting services, STRATO may process personal data generated through the use of the platform. This includes, in particular, server log data as well as user and content data stored in the database and on the web server.

The processing serves the secure and reliable provision of the platform. The legal basis is Art. 6(1)(f) GDPR and, insofar as the processing is necessary for the provision of contractual platform functions, Art. 6(1)(b) GDPR. A data processing agreement pursuant to Art. 28 GDPR has been concluded with STRATO.

Cloudflare Turnstile, a service provided by Cloudflare, Inc., is used to protect registration and login against automated access, bots, and misuse.

When Turnstile is used, technical information is processed that is necessary to assess whether a request originates from a human or an automated system. This may include, in particular, IP address, device and browser information, as well as other technical security data.

The processing serves to protect the platform and its users against automated attacks and abusive login or registration attempts. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the security and functionality of the platform.

If users contact us by email, the information transmitted is processed for the purpose of handling the respective inquiry. This may include, in particular, name, email address, content of the message, time of communication, and any other information voluntarily provided.

Insofar as the communication serves the initiation or performance of a contract, the processing is carried out on the basis of Art. 6(1)(b) GDPR. In other cases, it is carried out on the basis of Art. 6(1)(f) GDPR. The legitimate interest lies in the proper handling and documentation of inquiries.

Email services provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which form part of the hosting package used, are used for receiving and sending emails. In the context of email communication, sender and recipient addresses, message content, sending and receiving times, as well as technical delivery and log data may in particular be processed.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with STRATO.

Personal data is transferred to external service providers or other recipients only insofar as this is necessary for the provision, security, and administration of the Baumvolk platform.

The external service providers currently used include, in particular, STRATO GmbH for hosting, database operation, and email services, as well as Cloudflare in connection with bot and misuse protection through Cloudflare Turnstile. Further details on these services are provided in the respective sections of this Privacy Policy.

Web analytics with Matomo is operated in-house. The analytics data collected in this context is processed on infrastructure hosted by STRATO and is not transmitted to the provider of Matomo.

Insofar as external service providers process personal data on behalf of the controller, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR, where legally required. Personal data is only disclosed to the extent necessary and in accordance with the applicable legal requirements.

Personal data is transferred to countries outside the European Union or the European Economic Area only if the legal requirements for such a transfer are met.

In connection with the use of Cloudflare Turnstile, the processing of personal data by Cloudflare, Inc. in the United States cannot be ruled out.

Cloudflare is certified under the EU-U.S. Data Privacy Framework. The adequacy decision of the European Commission regarding the EU-U.S. Data Privacy Framework may therefore serve as the basis for data transfers to the United States. In addition, Cloudflare provides for EU Standard Contractual Clauses and supplementary safeguards for international data transfers.

According to the current status of the Baumvolk platform, no further transfers of personal data to third countries take place. If additional services are used in the future that involve transfers to third countries, this Privacy Policy will be updated accordingly.

Personal data is stored only for as long as is necessary for the respective processing purpose or for as long as statutory retention obligations apply.

Account data is generally stored for the duration of the user account. After an account is deleted, personal data is deleted or anonymized unless statutory retention obligations, security interests, or the rights of third parties prevent this. Published content may need to be stored for a longer period insofar as this is necessary to safeguard legitimate interests or the rights of third parties.

Technical log data, security data, and email logs are stored only for as long as is necessary for operational security, error analysis, misuse prevention, and the handling of the respective communication. Longer storage may take place where necessary to investigate a security incident or comply with legal obligations.

Documents relevant under commercial and tax law are stored in accordance with the applicable statutory retention periods. Depending on the type of document, these periods may extend over several years.

Personal data relating to voluntarily submitted media contributions is generally stored for as long as this is necessary for the administration and use of the respective media contribution and for documenting the granted rights of use.

If a media contribution is not used or its future use is discontinued, personal data that is no longer required will be deleted unless statutory retention obligations or legitimate interests, in particular the documentation of previous uses or the establishment, exercise, or defense of legal claims, justify further storage.

Data subjects have, subject to the applicable legal requirements, in particular the following rights:

- Right of access pursuant to Art. 15 GDPR,
- Right to rectification pursuant to Art. 16 GDPR,
- Right to erasure pursuant to Art. 17 GDPR,
- Right to restriction of processing pursuant to Art. 18 GDPR,
- Right to data portability pursuant to Art. 20 GDPR,
- Right to object pursuant to Art. 21 GDPR,
- Right to withdraw consent with effect for the future.

In addition, data subjects have the right to lodge a complaint with a data protection supervisory authority. This right exists in particular with the supervisory authority of the data subject’s habitual residence, place of work, or the place of the alleged infringement.

Insofar as personal data is processed on the basis of Art. 6(1)(f) GDPR, data subjects may object to such processing at any time on grounds relating to their particular situation.

In the event of an objection, the personal data concerned will no longer be processed unless compelling legitimate grounds for the processing can be demonstrated which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims.

Appropriate technical and organizational measures are taken to protect personal data against loss, unauthorized access, manipulation, disclosure, and other misuse.

The measures used may include, in particular, encrypted data transmission, access restrictions, role and authorization concepts, security logging, backups, regular updates, and measures to protect user accounts.

Despite appropriate protective measures, complete security of data transmission and data processing cannot be guaranteed.

This Privacy Policy may be amended if the legal situation, platform functions, service providers used, or the nature of data processing changes.

The current version published on this website applies. Users will be informed of material changes in an appropriate manner.